- A hacker is selling 20,000 databases allegedly stolen from the main site of the Tezpur University.
- The seller has given away a sample of the data that we confirmed to contain valid information.
- The public educational institute hasn’t admitted a data breach or a hacker intrusion yet.
Someone is selling a set of databases that they claim are the result of a hack against Tezpur University, a large public educational institute in North-Eastern India. The seller has set a price of $25, although he asked us to bid when contacted, and promises 20,000 database entries in return.
The details shown in the sample images include full names, dates of birth, email addresses, states, gender, phone numbers, religion, age, current address, permanent address, father’s name, mother’s name, spouse’s name, blood type, and more.
We have called some of the people listed on the sample, and we were able to confirm that they had applied to the university a few years back, so the data appears to be valid. By contacting the seller directly, we found out that the same person is also the hacker who managed to breach into the "tezu.ernet.in" site and exfiltrate the data. The user has no other sales listed on the forums where the post appeared, so he/she seems to be an independent hacker, not a data broker.
We have also reached out to the Tezpur University to ask whether they have detected any intrusions on their network and can confirm anything other than what is given away by the seller, but we have not heard back from them yet. As soon as we receive a comment, we will update this post.
Tezpur University was established by the Indian Parliament back in 1994, and it operates a large number of schools, departments, research centers, etc. As such, if someone was able to exfiltrate the institute's databases, that means the incident would affect a very large number of students and applicants at the university, far greater than 20,000.
If you are a former or present member at Tezpur University, consider your personal details leaked. From the price set by the seller, we can deduce that your data will soon fall into the hands of numerous actors, many of whom may engage in scamming and phishing tricks against you. Due to the richness of the information included in the stolen databases, a capable crook would have everything needed for a convincing social engineering attack, so beware.